GitHub Action

name: AI Agent Security Scan
on: [push, pull_request]
 
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: inkog-io/inkog@v1
        with:
          api-key: ${{ secrets.INKOG_API_KEY }}
          path: '.'
          policy: 'balanced'

name: AI Agent Security (Diff Mode)
on:
  push:
    branches: [main]
  pull_request:
 
permissions:
  contents: write
  security-events: write
  pull-requests: write
 
jobs:
  # Update baseline on main branch
  update-baseline:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: inkog-io/inkog@v1
        with:
          update-baseline: 'true'
          fail-on-findings: 'false'
      - name: Commit Baseline
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .inkog-baseline.json
          git diff --cached --quiet || git commit -m "chore: update security baseline"
          git push
 
  # Check for regressions on PRs
  check-regression:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download baseline
        run: |
          git fetch origin main
          git show origin/main:.inkog-baseline.json > .inkog-baseline.json 2>/dev/null || echo '{"findings":[]}' > .inkog-baseline.json
      - uses: inkog-io/inkog@v1
        with:
          diff: 'true'
          fail-on-findings: 'true'

name: EU AI Act Compliance
on:
  schedule:
    - cron: '0 9 * * 1'  # Weekly audit
  pull_request:
 
jobs:
  compliance:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: inkog-io/inkog@v1
        with:
          policy: 'eu-ai-act'
          fail-on-findings: 'false'
      - name: Save Report
        run: inkog -path . -policy eu-ai-act -output html > compliance-report.html
      - uses: actions/upload-artifact@v4
        with:
          name: eu-ai-act-compliance
          path: compliance-report.html
          retention-days: 90

- uses: inkog-io/inkog@v1
  id: scan
  with:
    path: '.'
 
- name: Check Results
  run: |
    echo "Total findings: ${{ steps.scan.outputs.findings-count }}"
    echo "Risk score: ${{ steps.scan.outputs.risk-score }}"
    if [ "${{ steps.scan.outputs.critical-count }}" -gt 0 ]; then
      echo "::error::Critical vulnerabilities detected!"
    fi

## ⚠️ Inkog Security Scan

| Metric | Value |
|--------|-------|
| **Status** | 2 high severity issues found |
| **Risk Score** | 65/100 |
| 🔴 Critical | 0 |
| 🟠 High | 2 |
| 🟡 Medium | 1 |
| 🟢 Low | 0 |

### Top Findings
- 🟠 **User input flows to LLM prompt** - `agent.py:42`
- 🟠 **Unbounded loop in tool call** - `tools.py:89`

permissions:
  security-events: write  # For SARIF upload
  pull-requests: write    # For PR comments
  contents: write         # For baseline commits (diff mode)